Improving Security in Node.js

A collection of tips and ideas to improve the security of a Node.js application.

Don't let your app identify itself as a Node.js application

In the response header you might have:
X-Powered-By: Express
Set-Cookie: connect.sid: sJbhAJcKt1JVuCRZ5HwpYMhFBAKaXm0

The first item identifies that your application is using Express.js which identifies Node. The second in a similar manner identifies the Connect middleware for session management, again a Node module.

The fixes for these are very simple. To suppress the X-Powered-By header key/value you should do this:

app = express();
app.disable('x-powered-by');

For the connect.sid identifier you can change the default name by using the "key" key in the initialization object:

app.use(session({
  key: '<customize me>',
  ...

ExpressJS and MongoDB End to End

This blog post accompanies the presentation called ExpressJS and MongoDB End to End at Desert Code Camp 2014.1.

If you want to follow along with this presentation then there are three items you need:

1. Install Node.
2. Install MongoDB.
3. Clone the ExpressJS Sample.

Once you've cloned the sample this locally you should be able to run it using:
node app.js
If MongoDB is running on the default port then it should work.

Give me feedback when the presentation is over: Guy on Speaker Rater

Resources from presentation:

• Official ExpressJS site: ExpressJS
• Node: nodejs.org
• MongoDB: mongodb.org
• Mongoose: mongoosejs.com

How many Friday 13ths in a Year in JavaScript

Inspired by a code golf question on codegolf.stackexchange.com asking for code that counted the number of Friday 13ths in a year I came up with this inefficient NodeJS/JavaScript solution. Both the solutions below can be dropped into a .js file and run from the command line by NodeJS.

// To run:
// node friday13.js <2013>
// <2013> is the year which you want a count of Friday 13ths in

// Add a day incrementer to the Date prototype
Date.prototype.addDays = function (num) {
    var value = this.valueOf();
    value += 86400000 * num;
    return new Date(value);
}

var year = process.argv[2];
if(!year){
 console.log('Was year the first param? Received: ' + year);
 return;
}

var startDate = new Date(year,0,1);
console.log(startDate);

var endDate = new Date(year,11,31);
console.log(endDate);

var counter = 0;
while(startDate <= endDate) {
 if(startDate.getDay() === 5 && startDate.getDate() === 13) {
  counter++;
 }
 startDate = startDate.addDays(1);
}

console.log(counter + ' Friday 13ths in ' + year);

Someone else came up with another JavaScript solution which takes advantage of some of the idiosyncrasies of JavaScript which I thought was interesting:

var year = process.argv[2];

var numFridays = function(year) {
 var count=0;
 for(month=12;month--;) {
  count += !new Date(year,month,1).getDay();
 }
 return count;
}

console.log('Number: ' + numFridays(year));

Here are the interesting parts:

1. The for loop on line 5 relies on the fact that when the value of month hits zero it will evaluate to false.
2. On line 5 month will be evaluated for truthiness before it's decremented and that it will be decremented before the body of the for loop is evaluated.
3. We only have to loop through the 12 months of the year as there can only be one Friday 13th in each month so no need to go through every day.
4. The JavaScript getDay() method of the Date object returns a 0 for Sunday, 1 for Monday etc. If the month has a Friday 13th then by definition the first day of the month is a Sunday. i.e. if the value of getDay() on the 1st of the month is 0 (equivalent to false) then count this month. To do that we ! (not) the return value which gives us true which will evaluate as the value of 1 when added to an integer.

Useful NPM commands

My notebook for NPM commands that I find useful.

i can be used instead of install

npm -g list
- Shows everything that you've installed globally in a dependency tree graph.

npm list
- Shows everything that you've installed locally in a dependency tree graph.

Full stack JavaScript is not about sharing code front to back

I'm watching a panel discussion at Node Summit and noticed one of the panelists saying that they found that there was very little benefit to sharing code between the front and back end when developing in a JavaScript full stack environment.

Recently I was touting the virtues of NodeJS and the person I was speaking to said "in reality how much code can you share across the stack?" I had to point out that this was not a virtue that I extolled and I've never thought of this to be a benefit of JS full stack.

In my opinion, shared code across the stack is a bonus and not a benefit. The primary benefit comes from the synergies and efficiencies in working in a single language through the stack. This means that if someone who traditionally worked on the front end has to dive in and do some work on the back end they are not going to be shocked by a different syntax and instead will be somewhat comfortable with what they see.

NodeJS Express Automatic Content Type

Try this in a NodeJS Express application. Add a route as shown below and take a look at what the web page shows:

app.get('/mytest', function(req,res){
    var testdata = {
        segment: 'Five',
        value: '42',
        environment: 'development'
    };
    res.send(testdata);
});

Before you go to this page in your browser, probably something like http://localhost:3000/mytest you should bring up the Developer Tools, on Chrome you can do this by hitting F12 or Ctrl+Shift+i.

In the browser you will see:

{
  "segment": "Five",
  "value": "42",
  "environment": "development"
}

In the Developer Tools take a look at the Response Headers in the Headers section. You will see that Content-Type is set to application/json; charset=utf-8

Now let's change the mytest function to the following:

app.get('/mytest', function(req,res){
    res.send('this is my data');
});

The browser will now show you:

this is my data

If you look at the developer tools you'll see that the Content-Type is now text/html; charset=utf-8

NodeJS/Express detected the type of data that you're sending back to the browsers and adjusted the Content-Type appropriately.

OSCON Adventures in Node.js

The Adventures in Node.js page on OSCON.

Faisal Abid (Dynamatik, Inc.)
2:30pm Thursday, 07/25/2013

node.js is built around "events"
event loop is always running checking for new events
fires callbacks when new events are received

http.createServer(function(request, response) {
    // request has all information about request
    // response allows packaging of what will be returned to client.

}

use EventEmitter class to write custom events
 - can help with callback hell

require is used to import modules to your application.
- modules are like classes
- http module is stored in the node_modules folder
- require returns a JSON object

in examples using nodemon

npm is used to get modules
npm.org -
run from cmd line:
npm install socket.io
npm install nodemon
npm install -g coffee-script

package.json is a manifest for node
"npm install" will read package and work out and download required packages
use * in package to get latest version otherwise specify version number
npm install --save hbs - adds to package.json?

Express.js
- framework like sinatra
- REST API for node
- great support for templates
- templates: Jade, EJS, Dust (LinkedIn now owns Dust)

restangular - simplify rest on angular

node has 32k modules out there, huge community support